JP7199610B2 - SECURITY MEASURE SUPPORT DEVICE, SECURITY MEASURE SUPPORT METHOD, AND PROGRAM - Google Patents

Description

The present disclosure relates to a security measure support device, a security measure support method, and a program.

Conventionally, there have been proposals for systems and methods for mediating conclusion of insurance contracts between business operators (for example, companies) having facilities and insurance companies (see, for example, Patent Document 1). In addition, with the spread of IT (Information Technology) equipment, there is an increasing need to introduce cybersecurity countermeasure products for protecting equipment from cyberattacks. In this way, businesses that own equipment need to prepare for cyberattacks by combining hardware, software, or cybersecurity countermeasure products consisting of these with a non-life insurance policy to compensate for damage.

JP-A-2003-022368

However, cyber attack methods and cyber security technologies adopted by cyber security countermeasure products are changing day by day. For this reason, it is necessary for businesses with equipment to properly determine what kind of cybersecurity countermeasure products to introduce and what kind of damage insurance (for example, insurance premiums and contract compensation fees) should be contracted. The problem is that it is difficult to decide.

An object of the present disclosure is to facilitate appropriate determination of the cybersecurity countermeasure product to be installed in the facility and the content of the insurance to be contracted.

The security measure support device of the present disclosure includes security level information indicating the security level of a cybersecurity measure product installed in a facility that communicates via an external network, and information regarding a cyber attack on the facility via the external network. An information acquisition unit that acquires attack information and equipment information related to the operation status of the equipment, and an insurance that compensates for profits lost due to cyber attacks on the equipment from the security level information, the attack information, and the equipment information Inference for outputting candidates for the insurance premium and the contract compensation amount from the security level information, the attack information, and the equipment information using a first learning model for calculating the insurance premium and the contract compensation amount and a part.

Further, the security measure support method of the present disclosure is a method executed by a computer, wherein security level information indicating the security level of a cybersecurity measure product installed in a facility that communicates via an external network; a step of obtaining attack information, which is information about a cyber attack on the equipment via a network, and equipment information about the operation status of the equipment; Using a first learning model for calculating insurance premiums and contract compensation amounts for compensating profits lost due to attacks, the insurance premiums and the insurance premiums and the contract compensation amounts are calculated from the security level information, the attack information, and the facility information. and a step of outputting candidates for the contract compensation amount.

According to the device, method, and program of the present disclosure, it becomes easy to appropriately determine the cybersecurity countermeasure product to be installed in the facility and the content of the insurance to be contracted.

1 is a block diagram schematically showing equipment that can be targeted by a cyber attack and a security measure support device according to an embodiment; FIG. It is a figure which shows the hardware constitutions of the security measure assistance apparatus which concerns on embodiment. 3 is a block diagram showing the configuration of a learning device of the security measure support device according to the embodiment; FIG. 4 is a flow chart showing the operation of the learning device shown in FIG. 3; 3 is a block diagram showing the configuration of an inference device of the security measure support device according to the embodiment; FIG. 6 is a flow chart showing the operation of the inference apparatus shown in FIG. 5; 4 is an explanatory diagram showing the operation of the security measure support device according to Embodiment 1; FIG. FIG. 9 is an explanatory diagram showing another operation of the security measure support device according to the first embodiment; FIG. 10 is an explanatory diagram showing the operation of the security measure support device according to the second embodiment; 9 is a flow chart showing the operation of the security measure support device according to the second embodiment; FIG. 12 is an explanatory diagram showing the operation of the security measure support device according to the third embodiment; FIG. 5 is a diagram showing a modification of the configuration of the security measure support device according to Embodiments 1 to 3;

A security measure support device, a security measure support method, and a program according to embodiments of the present disclosure will be described below with reference to the drawings. The following embodiments are merely examples, and the embodiments can be combined as appropriate and each embodiment can be modified as appropriate.

1 to 6 are diagrams relating to the security measure support device 1 according to the first to third embodiments. FIG. 1 is a block diagram schematically showing a facility 5 that can be targeted by a cyber attack and a security measure support device 1. As shown in FIG.

The facility 5 is, for example, factory equipment that produces products, a computer of a business operator (for example, a company) that provides services as products, power generation equipment of an electric power company that supplies power as products, and the like. . The facility 5 has communication circuitry for enabling communication with external networks. The external network is, for example, the Internet or an intranet that connects the facility 5 with similar facilities or computers at other locations. The security measure support device 1 is a device that implements the security measure support method according to the embodiment. Also, the security measure support device 1 is a device (for example, a computer) that executes the program according to the embodiment.

The security measure support device 1a according to the first embodiment outputs candidates for insurance contract details such as insurance premiums and contract compensation amounts (that is, insurance claims) for equipment 5 (see FIG. 7 to be described later). (shown in FIG. 8 below), output of a compensation amount for compensating for profits lost by the business operator having the facility 5 due to a cyber attack (shown in FIG. 8 described later), and the like.

The security measure support device 1b according to the second embodiment dynamically (for example, automatically) changes the content of the insurance contract, such as the insurance premium and contract compensation amount for the facility 5 (to be described later). 9).

For example, the security measure support device 1c according to the third embodiment proposes a new cybersecurity measure product based on a security hole discovered after the cybersecurity measure product is introduced and insurance is contracted (described later. 10).

As shown in FIG. 1, the facility 5 includes a switching hub 51, which is a relay device connected to an external network, and an attack detection device (that is, an attack detection server) 52 for detecting cyber attacks and suspicious accesses. , and a local network 53 such as a LAN (Local Area Network) connected to a switching hub 51 . The equipment 5 also includes equipment 56a, 56b, 56c, . a server) 54, a storage unit 55 for storing required recovery time, and a storage unit 57 for storing production plans and the like. The storage unit 55 stores, for example, a required recovery time T1, which is the time from when the operation of the equipment 5 is stopped due to a cyber attack to when the operation of the equipment 5 resumes. The required recovery time T1 may be the time from when each of the devices 56a, 56b, 56c, . . . The storage unit 57 stores, for example, a production plan (for example, a planned production volume) of products to be produced by the equipment 5 .

The facility 5 has a warning unit 58 that warns the user based on cyberattacks and suspicious access. The facility 5 also has a notification unit 59 that issues a notification to the user. The configuration of the equipment 5 is not limited to that shown in FIG. For example, attack detection device 52 may be part of appliance controller 54 . Also, the device control device 54 may be provided in each of the devices 56a, 56b, 56c, . In addition, the device control device 54 and the attack detection device 52 are provided with cyber security countermeasure products. Cybersecurity countermeasure products consist of hardware, software, or a combination of these to protect facilities from cyberattacks. A cybersecurity countermeasure product may be provided in each of the devices 56a, 56b, 56c, .

The security measure support device 1 is connected to a local network 53 . However, the security measure support device 1 may be part of the facility 5 . The security measure support device 1 can use a learning model (also referred to as a "learned model") generated by machine learning using learning data to propose cybersecurity measures products, insurance contracts, and the like. It has an inference device 3 . The learning model may be generated using artificial intelligence such as deep learning. The security measure support device 1 also has a learning device 2 that generates a learning model used by the inference device 3 . However, the inference device 3 and the learning device 2 may be separate and independent devices. For example, the security measure support device 1 has an inference device 3 and can acquire a learning model from an external learning device.

The security measure support device 1 provides, for example, security level information SL indicating the security level of a cybersecurity measure product installed in a facility 5 that communicates via an external network, and information on a cyberattack to the facility 5 via an external network. Certain attack information AT and facility information FA regarding the operation status of the facility 5 are acquired.

The security level of a cybersecurity countermeasure product consists of, for example, a plurality of levels from a low level 1 to a high level N (N is an integer equal to or greater than 2). The security level is determined, for example, based on the data encryption algorithm employed by the facility 5, the physical security employed by the facility 5 (for example, entrance/exit management), and the like.

The attack information AT includes, for example, information indicating the frequency of occurrence of cyber-attacks on the facility 5, and information on suspicious access, which is access to the facility 5 via an external network from a source that is not permitted to access the facility 5. Include one or both of the information indicating the frequency of occurrence.

The facility information FA is, for example, information indicating the required recovery time T1, which is the time from when the facility 5 is subjected to a cyber attack and the facility 5 stops operating until the facility 5 resumes operation. Information indicating the amount of decrease in the amount of products produced by the facility 5 when the amount of products produced by the facility 5 is reduced from the production amount determined in the production plan, Information indicating the damage suffered by the purchaser due to a decrease in the amount of the product supplied to the purchaser of the product, from the time when the warning is issued to the time when the user starts security measures for the equipment 5 information indicating the required response time T2, which is the time of A purchaser of a product is, for example, an electric power user who receives power as the product.

FIG. 2 is a diagram showing the hardware configuration of the security measure support device 1. As shown in FIG. The security measure support device 1 has a CPU (Central Processing Unit) 11 as an information processing section, a memory 12 as a storage device, an output section 13 for outputting information, and an input section 14 for inputting information.

The input unit 14 is, for example, a keyboard, a mouse, a touch panel as a user operation unit, an input interface as a signal input unit, and the like. The output unit 13 is, for example, a display as a video output unit, a speaker as an audio output unit, and an output interface as a signal output unit.

Each function of the security measure support device 1 is implemented by a processing circuit. For example, the security measure support device 1 includes security level information SL indicating the security level of the cybersecurity measure product installed in the facility 5, attack information AT that is information relating to a cyber attack on the facility 5 via an external network, and the facility 5 acquires equipment information FA regarding the operation status of equipment 5, and from security level information SL, attack information AT, and equipment information FA, insurance premium 6 and contract compensation amount 7 for compensating for profits lost due to cyber attack on equipment 5 A processing circuit for outputting candidates for insurance premium 6 and contract compensation amount 7 from security level information SL, attack information AT, and facility information FA using learning model M1 for calculating .

The processing circuit may be dedicated hardware or may be the CPU 11 that executes a program stored in the memory 12 . The CPU 11 may be any of a processing device, an arithmetic device, a microprocessor, a microcomputer, a processor, and a DSP (Digital Signal Processor).

If the processing circuit is dedicated hardware, the processing circuit may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array). ), or a combination of any of these.

When the processing circuit is the CPU 11, the functions of the security measure support device 1 are implemented by software, firmware, or a combination of software and firmware. Software and firmware are written as programs and stored in the memory 12 . The processing circuit reads out and executes a program stored in the memory 12 to realize the function of each section. That is, when the processing is executed by the processing circuit, the security measure support device 1 acquires the security level information SL, the attack information AT, and the equipment information FA, and obtains the security level information SL, the attack information AT, and the equipment information FA. Security level information SL, attack information AT, and security level information SL, attack information AT and A memory 12 is provided for storing a program for outputting candidates for the insurance premium 6 and contract compensation amount 7 from the facility information FA. It can also be said that these programs cause the computer to execute the security measure support method.

Here, the memory 12 is, for example, RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory, etc.) It is either a volatile semiconductor memory, a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), or the like.

A part of the security measure support device 1 may be realized by dedicated hardware, and a part thereof may be realized by software or firmware. As such, the processing circuitry may implement each of the functions described above in hardware, software, firmware, or any combination thereof.

FIG. 3 is a block diagram showing the configuration of the learning device 2. As shown in FIG. The learning device 2 uses an information acquisition unit 21 that acquires learning data including security level information SL, attack information AT, and facility information FA, and uses the acquired learning data to infer the content of a suitable insurance contract. and a model generating unit 22 for generating a learning model for performing. Here, the learning data is data in which each piece of input information is associated with each other. The generated learning model is stored in the storage unit 4a. The storage unit 4 a may be part of the learning device 2 .

FIG. 4 is a flow chart showing the operation of the learning device 2 shown in FIG. In step S11, the information acquisition unit 21 acquires all or part of the security level information SL, attack information AT, and facility information FA. Although the security level information SL, the attack information AT, and the equipment information FA are acquired at the same time, these information may be acquired at different timings as long as they can be input in association with each other.

In step S12, the model generation unit 22 executes learning processing according to learning data created based on the combination of the security level information SL, the attack information AT, and the facility information FA acquired by the information acquisition unit 21 ( For example, machine learning the contents of insurance contracts) to generate a learning model. Note that the learning model may be updated based on the actual data of the security level information SL, attack information AT, and facility information FA.

In step S<b>13 , the storage unit 4 a stores the learning model generated by the model generation unit 22 .

FIG. 5 is a block diagram showing the configuration of the inference device 3. As shown in FIG. The inference device 3 has an information acquisition unit 31 that acquires data including one or more of security level information SL, attack information AT, and facility information FA, and stores the acquired data in the learning model generated by the learning device 2. and an inference unit 32 for inputting and outputting an inference result. As the learning model, one stored in the storage unit 4b is used. The storage unit 4 b may be part of the inference device 3 .

FIG. 6 is a flow chart showing the operation of the inference device 3 shown in FIG. In step S21, the information acquisition unit 31 acquires all or part of the security level information SL, attack information AT, and facility information FA. Although the security level information SL, the attack information AT, and the equipment information FA are acquired at the same time, these information may be acquired at different timings as long as they can be input in association with each other.

In steps S22 and S23, the inference unit 32 outputs an inference result obtained using the learning model stored in the storage unit 4b. That is, by inputting the security level information SL, the attack information AT, and the facility information FA acquired by the information acquisition unit 31 into this learning model, the content of the insurance contract is inferred, and the inference result is output.

Note that the inference device 3 may acquire a learning model from an external learning device and output an inference result based on this learning model.

The learning device 2 and the reasoning device 3 are connected to the control system of the facility 5 via a network, for example. Also, the learning device 2 and the reasoning device 3 may be built in the facility 5 . Furthermore, the learning device 2 and the reasoning device 3 may exist on a cloud server.

Information input to the information acquisition unit 21 of the learning device 2 can also be added or removed. Furthermore, the model generation unit 22 of the learning device 2 may update the learning model by re-learning.

Embodiment 1.
FIG. 7 is an explanatory diagram showing the operation of the security measure support device 1a according to the first embodiment. In the example of FIG. 7, the data input to the security measure support device 1a are security level information SL, the frequency of occurrence of cyber attacks and the frequency of occurrence of suspicious access, which are attack information AT, and the required recovery time, which is facility information FA. Includes T1 (predicted value) and decrease in production volume of products (predicted value). However, the data input to the security measure support device 1a need not be all of these. Further, the facility information FA input to the security measure support device 1a may include the damage (predicted value) of the product purchaser. The facility information FA input to the security support device 1a may include the required response time T2 (predicted value).

In this case, the inference unit 32 of the inference device 3 of the security measure support device 1a calculates the insurance premium for compensating for the profits lost due to the cyber attack on the equipment 5 from the security level information SL, the attack information AT, and the equipment information FA. 6 and the contract compensation amount 7, candidates for the insurance premium 6 and the contract compensation amount 7, i.e., the insurance contract's Output content candidates.

For example, if the security level of the cyber security countermeasure product introduced in the facility 5 is low, it can be expected that the damage caused by the cyber attack will be large. We propose the contents of an insurance contract with a high contract compensation amount 7 in . Further, the security measure support device 1a may set a lower ratio of the contract compensation amount 7 to the insurance premium 6 as the security level is lower.

Further, for example, when the frequency of occurrence of cyber-attacks on the facility 5 is high, it can be expected that the possibility of being damaged by the cyber-attacks is high. The content of an insurance contract with a premium of 6 and a high contract compensation amount of 7 is proposed. In addition, the security measure support device 1a may set the ratio of the contract compensation amount 7 to the insurance premium 6 lower as the frequency of occurrence of cyberattacks increases.

Further, for example, when the frequency of occurrence of suspicious access to the equipment 5 is high, it can be expected that there is a high possibility that a preliminary act of a cyber attack is occurring. As is, the content of the insurance contract with a higher insurance premium 6 and a higher contract compensation amount 7 is proposed. Further, the security measure support device 1a may set the ratio of the contract compensation amount 7 to the insurance premium 6 lower as the frequency of occurrence of suspicious access is higher.

Further, for example, if the required recovery time T1 (predicted value) is long when the operation of the facility 5 is stopped due to a cyber attack, the amount of damage can be expected to be large. value), the content of the insurance contract with a higher insurance premium 6 and a higher contract compensation amount 7 is proposed. Further, the security measure support device 1a may set a lower ratio of the contract compensation amount 7 to the insurance premium 6 as the required recovery time T1 (predicted value) is longer.

Further, for example, if the required response time T2 (predicted value) of the user after the warning is issued by the equipment 5 is long, it can be expected that the equipment 5 has low defense capability and defense awareness against cyber attacks. proposes an insurance contract with a higher insurance premium 6 and a higher contract compensation amount 7 as the required response time T2 (predicted value) is longer. Further, the security measure support device 1a may set a lower ratio of the contract compensation amount 7 to the insurance premium 6 as the required response time T2 (predicted value) is longer.

Further, for example, if the amount of decrease (predicted value) in the production volume of the product when the facility 5 is attacked by a cyber attack is large, it can be expected that the damage due to the cyber attack on the facility 5 will be large. , the content of the insurance contract with a higher insurance premium 6 and a higher contract compensation amount 7 is proposed as the amount of decrease (predicted value) in the production volume of the product increases. Further, the security measure support device 1a may set the ratio of the contract compensation amount to the insurance premium to be lower as the amount of decrease (predicted value) of the production amount of the product is larger.

Further, for example, if the damage (predicted value) to the purchaser of the product when the equipment 5 is attacked by a cyber attack is large, it can be expected that the damage due to the cyber attack on the equipment 5 will be large. The larger the damage (predicted value) of the purchaser of the product, the higher the insurance premium 6 and the higher the contract compensation amount 7 the content of the insurance contract is proposed. Further, the security measure support device 1a may set the ratio of the contract compensation amount 7 to the insurance premium 6 to be lower as the damage (predicted value) of the product purchaser is larger.

According to the security countermeasure support device 1a of FIG. 7, it is possible to appropriately propose the security level of the cybersecurity countermeasure product and the contents of the insurance contract. Therefore, the business operator having the equipment 5 can easily determine the content of the cyber security countermeasure product and the insurance contract.

Further, according to the security measure support device of FIG. 7, it is possible to dynamically change the content of the insurance contract. Therefore, the business operator having the equipment 5 can easily determine the content of the cyber security countermeasure product and the insurance contract.

FIG. 8 is an explanatory diagram showing another operation of the security measure support device 1a. In the example of FIG. 8, the data input to the security measure support device 1a are the security level information SL, the frequency of occurrence of cyber attacks and the frequency of occurrence of suspicious access, which are attack information AT, and the required recovery time T1, which is facility information FA. , the required response time T2, and the decrease in the production volume of the product. However, the data input to the security measure support device 1a need not be all of these. The data input to the security measure support device 1a may include the damage of the product purchaser as the facility information FA.

In this case, the inference unit 32 of the inference device 3 of the security measure support device 1a calculates the compensation amount 7a for compensating for the profits lost due to the cyber attack on the equipment 5 from the security level information SL, the attack information AT, and the equipment information FA. Using a learning model for calculation, the compensation amount 7a is output from the security level information SL, the attack information AT, and the facility information FA.

For example, the security countermeasure support device 1a calculates and proposes a higher compensation amount as the security level of the cybersecurity countermeasure product introduced in the facility 5 is lower. Further, the security measure support device 1a may calculate the compensation amount so that the ratio of the compensation amount 7 to the insurance premium 6 becomes lower as the security level is lower.

Further, for example, the security measure support device 1a calculates a higher compensation amount as the current frequency of occurrence of cyberattacks increases. Further, the security measure support device 1a may calculate the compensation amount such that the higher the current frequency of occurrence of cyberattacks, the lower the ratio of the compensation amount to the insurance premium.

Also, for example, the security measure support device 1a calculates a higher compensation amount as the current frequency of occurrence of suspicious access is higher. Further, the security measure support device 1a may calculate the compensation amount such that the higher the current frequency of occurrence of suspicious access, the lower the ratio of the compensation amount to the insurance premium.

Also, for example, the security measure support device 1a calculates a higher compensation amount as the current required recovery time T1 is longer. In addition, the security measure support device 1a calculates the amount of compensation such that the longer the current required recovery time T1, the lower the ratio of the amount of compensation to the insurance premium.

Further, for example, the security measure support device 1a calculates a higher compensation amount as the current required response time T2 is longer. Further, the security measure support device 1a may calculate the compensation amount such that the longer the current required response time T2, the lower the ratio of the compensation amount to the insurance premium.

Also, for example, the security countermeasure support device 1a calculates a higher compensation amount as the amount of decrease in the production volume of the current product increases. Further, the security measure support device 1a may calculate the amount of compensation so that the ratio of the amount of compensation to the insurance premium becomes lower as the amount of decrease in the production volume of the current product increases.

Also, for example, the security measure support device 1a calculates a higher compensation amount as the current damage of the purchaser of the product is greater. Further, the security measure support device 1a may calculate the amount of compensation so that the ratio of the amount of compensation to the insurance premium becomes lower as the damage to the current purchaser of the product is greater.

According to the security countermeasure support device of FIG. 8, the current compensation amount can be calculated based on the security level of the cybersecurity countermeasure product and the current state of the facility 5 . Therefore, the business operator having the equipment 5 can easily determine whether the cybersecurity countermeasure product and the contents of the insurance contract are appropriate.

In addition, when the security countermeasure support device of FIG. 8 dynamically changes the content of the insurance contract, the current compensation amount can be calculated based on the security level of the cybersecurity countermeasure product and the current state of the equipment 5. . Therefore, the business operator having the equipment 5 can easily determine whether the cybersecurity countermeasure product and the contents of the insurance contract are appropriate.

Embodiment 2.
The security measure support device 1b according to the second embodiment differs from the security measure support device 1a according to the first embodiment in the program to be executed. In other respects, the security measure support device 1b according to the second embodiment is the same as the security measure support device 1a according to the first embodiment.

FIG. 9 is an explanatory diagram showing the operation of the security measure support device 1b. In the example of FIG. 9, the data input to the security measure support device 1b are the security level information SL, the frequency of occurrence of cyber attacks and the frequency of occurrence of suspicious access, which are attack information AT, and the required recovery time, which is facility information FA. It includes T1 (predicted value) and required response time T2 (predicted value). However, the data to be input need not be all of these. Further, the facility information FA to be input may include one or both of the amount of decrease in the production volume of the product (predicted value) and the damage to the purchaser of the product (predicted value).

In this case, the inference unit 32 of the inference device 3 of the security measure support device 1b calculates the insurance premium for compensating for the profits lost due to the cyber attack on the equipment 5 based on the security level information SL, the attack information AT, and the equipment information FA. Using a learning model M1 for calculating 6 and the contract compensation amount 7, the insurance premium 6 and the contract compensation amount 7 are dynamically set from the security level information SL, the attack information AT, and the facility information FA. In other words, in the second embodiment, the security measure support device 1b obtains the insurance premium 6 of the insurance contract, the contract compensation amount 7 which is the insurance money, or both of them according to the information input to the information acquisition unit 31. fluctuate.

FIG. 10 is a flow chart showing the operation of the security support device 1b. In the second embodiment, in step S31, the security measure support device 1b detects a security attack and suspicious access based on the detection signal from the attack detection device 52. FIG.

At step S32, the warning unit 58 of the facility 5 issues a warning to the user based on the cyberattack and suspicious access. The warning is given by means of display, output of sound from a speaker, lighting of a lamp, vibration transmitted to the user, and the like.

In step S33, the security measure support device 1b determines whether or not the user has taken security measures against cyberattacks and suspicious access.

If the security measures have started in step S33 (if the determination is YES), the security measure support device 1b detects the elapsed time since the warning in step S36, and in step S35, the security attack occurrence frequency and The content of the insurance contract is dynamically changed in accordance with the required response time T2, and the current content of the insurance contract is notified in step S38. A dynamic change in the content of an insurance contract can result in changes in the premium6 (i.e., increase or decrease), changes in the policy coverage7 (i.e., increase or decrease), or changes in the premium6 and the policy coverage7. is a combination of fluctuations in

In step S35, the security measure support device 1b proposes a higher contract compensation amount, for example, as the current required response time T2 is longer. Further, the security measure support device 1b calculates the contract compensation amount 7 so that the ratio of the contract compensation amount 7 to the insurance premium 6 becomes lower as the current required response time T2 becomes longer.

If the security measures have not started in step S33 (if the determination is NO), the security measure support device 1b detects the elapsed time since the warning in step S36, and in step S37, security measures have not been started for the reference time T2r or longer. is not started, dynamically change the content of the policy, and notify the content of the current policy in step S38.

In step S37, the security measure support device 1b proposes a higher contract compensation amount 7 than when security measures have been taken, for example, when security measures have not been started for the reference time T2r or longer. Further, the security measure support device 1b, for example, reduces the ratio of the contract compensation amount 7 to the insurance premium 6 as the current required response time T2 becomes longer than in the case where security measures are taken. Calculate

According to the security measure support device 1b of FIG. 9, it is possible to appropriately and quickly propose the security level of the cyber security measure product and the contents of the insurance contract according to the speed of security measures against suspicious access. Therefore, the business operator having the equipment 5 can easily and quickly determine the content of the cybersecurity countermeasure product and the insurance contract.

Further, according to the security measure support device 1b of FIG. 9, the content of the insurance contract can be dynamically changed. In this case, the business operator having the facility 5 does not have to consider the cybersecurity product and the insurance contract because the cybersecurity product and the insurance contract are automatically changed.

Embodiment 3.
The security measure support device 1c according to the third embodiment differs from the security measure support device 1a according to the first embodiment in terms of the program to be executed. In other respects, the security measure support device 1c according to the third embodiment is the same as the security measure support device 1a according to the first embodiment.

FIG. 11 is an explanatory diagram showing the operation of the security measure support device 1c according to the third embodiment. In the example of FIG. 11, the security countermeasure support device 1c is configured with the cybersecurity countermeasure product and the contents of the insurance contract by the method described in the first embodiment. Here, for example, if the insurance company checks the security of the facility 5 and finds a security hole against cyberattacks, it is necessary to review the content of the cybersecurity countermeasure product or the insurance contract. The security measure support device 1c proposes a candidate for a new cybersecurity measure product 8 based on the discovered security hole. The security measure support device 1c can also propose both candidates for new cybersecurity measure products 8 and candidates for new insurance contract contents based on the discovered security holes.

In this case, the inference unit 32 of the inference device 3 of the security measure support device 1c extracts the equipment 5 Using the learning model M2 for proposing a new cybersecurity countermeasure product 8 to be introduced into the system, from the security level information SL, attack information AT, facility information FA, and security hole information SH, a new cybersecurity countermeasure product We propose 8 candidates.

The security measure support device 1 c also has a learning device 2 that generates a learning model used by the inference device 3 . The learning device 2 acquires learning data including security level information SL, attack information AT, facility information FA, and security hole information SH from security level information SL, attack information AT, facility information FA, and security hole information SH. and a model generation unit 22 that generates a learning model for newly inferring a suitable cybersecurity countermeasure product using the acquired learning data. Here, the learning data is data in which each piece of input information is associated with each other. The generated learning model is stored in the storage unit 4a.

According to the security countermeasure support device 1c of FIG. 11, a new cybersecurity countermeasure product 8 can be appropriately proposed. Therefore, the business operator having the equipment 5 can easily determine the content of the cyber security countermeasure product and the insurance contract.

Modification.
FIG. 12 is a diagram showing a modification of the configuration of the security measure support device according to the first to third embodiments. 3 and 5, an example in which the learning device 2 and the inference device 3 are connected to separate storage units 4a and 4b has been described, but as shown in FIG. may be connected to the same storage unit 4 .

In addition, in FIG. 12, the information acquisition unit 21 and the information acquisition unit 31 can be made common to form a single information acquisition unit.

Reference Signs List 1, 1a, 1b, 1c security measure support device 2 learning device 3 reasoning device 4, 4a, 4b storage unit 5 equipment 6 insurance premium 7 contract compensation amount 8 cyber security product 11 CPU 12 memory 13 output unit 14 input unit 21 information acquisition unit 22 model generation unit 31 information acquisition unit 32 inference unit 52 attack detection device 54 device control device 56a, 56b, 56c devices 58 warning unit 59 Notification part SL Security level information AT Attack information FA Facility information SH Security hole information.

Claims (15)

Security level information indicating the security level of a cybersecurity countermeasure product installed in a facility that communicates via an external network, attack information that is information relating to a cyberattack to said facility via said external network, and the operating status of said facility an information acquisition unit that acquires equipment information about
using a first learning model for calculating, from the security level information, the attack information, and the equipment information, insurance premiums and contract compensation amounts for compensating profits lost due to cyberattacks on the equipment; , an inference unit that outputs candidates for the insurance premium and the contract compensation amount from the security level information, the attack information, and the facility information;
A security measure support device characterized by comprising: The security measure support device according to claim 1, wherein the attack information includes information indicating the frequency of occurrence of the cyber attack on the equipment. 2. The attack information includes information indicating the frequency of occurrence of suspicious access, which is access to the facility via the external network from a source that is not permitted to access the facility. 2. The security countermeasure support device according to 2 above. The equipment information includes information indicating a required recovery time, which is the time from when the equipment stops operating due to the cyberattack to when the equipment resumes operation. 4. The security measure support device according to any one of 1 to 3. 2. The facility information includes information indicating the amount of decrease in the amount of the product produced by the facility when the amount of the product produced by the facility is reduced due to the cyberattack on the facility. 5. The security measure support device according to any one of 4. The equipment information indicates the damage suffered by the purchaser due to a decrease in the amount of products produced by the equipment that has been attacked by a cyberattack and a decrease in the amount of products supplied to the purchaser of the products. 6. The security measure support device according to any one of claims 1 to 5, further comprising information. The facility has a warning unit that issues a warning to the user based on the cyber attack and suspicious access that is access to the facility via the external network from a source that is not permitted to access the facility,
7. The equipment information according to any one of claims 1 to 6, wherein the equipment information includes information indicating a required response time, which is the time from when the warning is issued to when the user starts taking security measures for the equipment. 1. The security countermeasure support device according to claim 1. 8. The security measure support device according to claim 7, wherein the reasoning unit increases or decreases the insurance premium and the contract compensation amount according to the response time required. 9. The inference unit outputs change information indicating a change in the insurance premium and the contract compensation amount when the security measures are not taken within a predetermined reference time. The security measure support device described in . If the attack information acquired by the information acquisition unit indicates the occurrence of a current cyber attack on the equipment,
10. Any one of claims 1 to 9, wherein the inference unit calculates a current compensation amount from the insurance premium, the contract compensation amount, the security level information, the attack information, and the equipment information. The security measure support device according to the item. From the insurance premium, the contract compensation amount, the attack information, the equipment information, information indicating the current cybersecurity countermeasure products installed in the equipment, and security hole information, which is information indicating security holes in the equipment, using a second learning model for proposing suitable cybersecurity countermeasure product candidates, the insurance premium, the contract compensation amount, the attack information, the equipment information, the information indicating the current cybersecurity countermeasure product, and The security measure support device according to any one of claims 1 to 10, wherein the new cyber security measure product is proposed from the security hole information. Further comprising a model generation unit that generates the first learning model for calculating the insurance premium and the contract compensation amount from the security level information, the attack information, and the equipment information. Item 12. The security measure support device according to any one of Items 1 to 11. To determine the new cybersecurity countermeasure product from the insurance premium, the contract compensation amount, the attack information, the equipment information, information indicating the current cybersecurity countermeasure product installed in the equipment, and the security hole information 12. The security measure support device according to claim 11, further comprising a model generation unit that generates said second learning model of. A security measure support method executed by a computer, comprising:
Security level information indicating the security level of a cybersecurity countermeasure product installed in a facility that communicates via an external network, attack information that is information relating to a cyberattack to said facility via said external network, and the operating status of said facility obtaining equipment information about
using a first learning model for calculating, from the security level information, the attack information, and the equipment information, insurance premiums and contract compensation amounts for compensating profits lost due to cyberattacks on the equipment; , a step of outputting candidates for the insurance premium and the contract compensation amount from the security level information, the attack information, and the facility information;
A security countermeasure support method characterized by comprising: Security level information indicating the security level of a cybersecurity countermeasure product installed in a facility that communicates via an external network, attack information that is information relating to a cyberattack to said facility via said external network, and the operating status of said facility obtaining equipment information about
using a first learning model for calculating, from the security level information, the attack information, and the equipment information, insurance premiums and contract compensation amounts for compensating profits lost due to cyberattacks on the equipment; , a step of outputting candidates for the insurance premium and the contract compensation amount from the security level information, the attack information, and the facility information;
A program characterized by causing a computer to execute

Images